CVE-2026-76904: 
Java vulnerability analysis and mitigation

CVE-2026-76904 is a critical SQL injection vulnerability in GeoTools, an open-source Java geospatial library, affecting the jsonArrayContains function in the PostGIS DataStore implementation. The vulnerability was published on August 21, 2026, and affects GeoTools versions 30.5 through 33.5, 34.0 through 34.4, and 35.0 when used with PostGIS 12 or greater against String or JSON fields. It carries a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory, Feedly).

The root cause (CWE-89) is improper neutralization of SQL special elements: the jsonArrayContains(<column>, <pointer>, <value>) function in FilterToSqlHelper.java writes the <value> parameter directly into the generated jsonb_path_exists SQL expression without escaping, allowing arbitrary SQL injection via crafted OGC Filter requests (GitHub Advisory). The fix, applied in commit d821c4d, introduces an escapeJsonLiteral() call before interpolating the value into the SQL template (GeoTools Commit). Exploitation requires no authentication and no user interaction — an attacker only needs network access to an endpoint that processes OGC Filters against a PostGIS-backed GeoTools layer running on PostGIS 12 or later. A public PoC exploit script (exploit.py) with Docker lab environment is available on GitHub (PoC Exploit).

Successful exploitation allows an unauthenticated remote attacker to inject and execute arbitrary SQL commands within the PostGIS database, resulting in high confidentiality, integrity, and availability impact. Attackers can read sensitive geospatial and application data, modify or delete database records, and — depending on the database user's privileges and PostgreSQL configuration — potentially escalate to operating system command execution (e.g., via COPY TO/FROM PROGRAM or similar mechanisms) (GitHub Advisory, Feedly). The NVD SSVC assessment classifies the technical impact as "total" and the vulnerability as automatable, indicating high risk of widespread exploitation (Feedly).

A high-confidence proof-of-concept exploit (exploit.py) is publicly available on GitHub, including complete instructions for unauthenticated remote code execution via SQL injection and a Docker Compose lab environment for testing (PoC Exploit). A Nuclei template for automated detection was also added to the ProjectDiscovery nuclei-templates repository shortly after disclosure. As of the time of reporting, there is no confirmed evidence of in-the-wild exploitation, and the vulnerability is not listed in the CISA KEV catalog (Feedly). The EPSS score is approximately 0.018 (1.8%), though the availability of a working PoC and the unauthenticated, network-accessible attack vector significantly elevate practical risk.

1. Reconnaissance: Identify internet-facing GeoServer or GeoTools-based services (e.g., via Shodan, Censys, or web crawlers) running affected GeoTools versions (30.5–33.5, 34.0–34.4, or 35.0) with PostGIS 12+ as the backend datastore.
2. Identify target layer: Enumerate available WFS or WMS layers that use PostGIS DataStore with String or JSON/JSONB column types, which are required for the jsonArrayContains function to be invoked.
3. Craft malicious OGC Filter: Construct an OGC Filter request that invokes the jsonArrayContains function with a specially crafted <value> parameter containing SQL injection payload (e.g., ' OR 1=1-- or more complex payloads for data extraction or command execution).
4. Send the request: Submit the crafted filter via an HTTP GET or POST request to the WFS endpoint (e.g., GetFeature with a CQL_FILTER or XML filter body), causing GeoTools to generate and execute the injected SQL against the PostGIS database without escaping.
5. Achieve objective: Depending on database user privileges, extract sensitive data via error-based or time-based blind SQL injection, modify records, or escalate to OS command execution using PostgreSQL's COPY TO PROGRAM or similar features (PoC Exploit, GitHub Advisory).

• Network: Unusual or malformed OGC Filter requests (WFS GetFeature, WMS GetMap with CQL filters) containing SQL metacharacters (', --, ;, UNION, SELECT, COPY) in jsonArrayContains value parameters; unexpected outbound database connections from the GeoServer/GeoTools host.
• Logs: Web server or GeoServer access logs showing requests with encoded or raw SQL injection strings in filter parameters; PostgreSQL logs (pg_log) recording unexpected SQL statements such as UNION SELECT, pg_sleep(), or COPY ... TO PROGRAM; GeoTools application logs showing SQL errors or unexpected query structures.
• Process: Unexpected child processes spawned by the PostgreSQL backend process (e.g., shell commands via COPY TO PROGRAM); unusual database user activity performing DDL or system-level operations.
• File System: New or modified files in PostgreSQL data directories or GeoServer deployment directories created by the database service account, potentially indicating OS-level command execution (PoC Exploit, GitHub Advisory).

Patches are available in GeoTools versions 33.6, 34.5, and 35.1 — users should upgrade to the appropriate patched release for their branch (GeoTools 33.6, GeoTools 34.5, GitHub Advisory). No configuration-based workaround fully mitigates the vulnerability; however, as a temporary risk-reduction measure, the PostGIS database connection pool should be configured with a least-privilege database user that restricts the scope of any injected SQL (e.g., read-only access, no COPY TO PROGRAM privileges). Restricting network access to GeoTools/GeoServer endpoints to trusted clients is also advisable while patching is underway.

The vulnerability received coverage from The Hacker Wire, which published a dedicated technical article on the SQL injection via OGC Filters (The Hacker Wire). Check Point Research added a defense advisory (CPAI-2026-10460), and the vulnerability was discussed in the r/pwnhub subreddit community. CTI tracking platforms including ctipilot.ch noted the vulnerability in their weekly rollups, and a Nuclei detection template was contributed to the ProjectDiscovery community repository shortly after disclosure.